Claims 

What is claimed is: 

1. A method of constructing one or more message parsing rules in accordance 
with a user and a machine, comprising the steps of: 
5 obtaining message data representing past messages; and 

generating one or more message parsing rules by a process based on at least one 
of one or more existing rule templates and user selection and classification of at least a 
portion of a message, wherein the one or more parsing rules are storable for access by a 
rule-based parsing system. 

10 2. The method of claim 1, wherein the past messages are associated with one of a 

network, an application and a system being analyzed. 

3. The method of claim 2, wherein the message data is obtained by at least one 
of: (i) reading past message data from one or more messages logs; and (ii) one of the 
network, the application and the system pointing to message data in existing data storage. 

15 4. The method of claim 1, wherein the rule-based parsing system comprises a 

message adaptation system. 

5. The method of claim 1, further comprising the step of establishing a message 
structure prior to the generating step. 

6. The method of claim 5, wherein when one or more existing rule templates are 
20 available, the step of establishing a message structure comprises the steps of: 

creating a message skeleton; 

matching the one or more rule templates against the message skeleton; and 
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providing potential matches to the user for validation and choice of a proper 
message structure. 



7. The method of claim 6, wherein when the message structure is found to be 
insufficient, templates are built by an iterative process between the user and the machine 

5 based on user selection of at least a portion of the message. 

8. The method of claim 7, wherein the iterative process further comprises 
demonstrative classification of the selected portion as one of a positive example and a 
negative example. 

9. The method of claim 6, wherein the message skeleton comprises information 
10 relating to one or more of a message start, a message end, and a separator between fields. 

10. The method of claim 1, wherein classification comprises user demonstration 
of at least one of a positive example and a negative example. 

11. The method of claim 10, wherein classification further comprises the steps of: 
the machine parsing message data sequentially until an unparseable message is 

15 encountered; 

the machine displaying the unparseable message to the user; 
the user selecting at least a portion of the unparseable message and marking the 
selected portion as one of a positive example and a negative example; and 

the machine learning based on the example and creating one or more candidate 

20 rules. 
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12. The method of claim 11, further comprising the step of the machine revising 
the one or more candidate rules based on feedback from the user. 

13. The method of claim 1, wherein each of the one or more generated parsing 
rules comprises a regular expression of a portion of a message. 

5 14. The method of claim 1, wherein each of the one or more generated parsing 

rules comprises a transformation rule of a portion of a message. 

15. The method of claim 14, wherein the transformation rule comprises a string 
constant. 

16. The method of claim 14, wherein the transformation rule comprises a 
10 permutation of one or more input tokens. 

17. Apparatus for constructing one or more message parsing rules, comprising: a 
memory; and 

at least one machine-based processor coupled to the memory and operative to: (i) 
obtain message data representing past messages; and (ii) generate one or more message 
15 parsing rules by a process based on at least one of one or more existing rule templates 
and user selection and classification of at least a portion of a message, wherein the one or 
more parsing rules are storable for access by a rule-based parsing system. 

18. The apparatus of claim 17, wherein the rule-based parsing system comprises 
a message adaptation system. 
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19. The apparatus of claim 17, wherein the processor is further operative to 
establish a message structure prior to the generating operation. 

20. The apparatus of claim 19, wherein when one or more existing rule templates 
are available, the operation of establishing a message structure comprises: 

creating a message skeleton; 

matching the one or more rule templates against the message skeleton; and 
providing potential matches to the user for validation and choice of a proper 
message structure. 

21. The apparatus of claim 17, wherein classification comprises user 
demonstration of at least one of a positive example and a negative example, 

22. The apparatus of claim 21, wherein classification further comprises the 
operations of: 

the machine parsing message data sequentially until an unparseable message is 
encountered; 

the machine displaying the unparseable message to the user; 
the user selecting at least a portion of the unparseable message and marking the 
selected portion as one of a positive example and a negative example; and 

the machine learning based on the example and creating one or more candidate 

rules, 

23. An article of manufacture for constructing one or more message parsing rules 
in accordance with a user and a machine, comprising a machine readable medium 
containing one or more programs which when executed implement the steps of: 

obtaining message data representing past messages; and 
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generating one or more message parsing rules by a process based on at least one 
of one or more existing rule templates and user selection and classification of at least a 
portion of a message, wherein the one or more parsing rules are storable for access by a 
rule-based parsing system. 
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